Uncaught Exception

Overview hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Uncaught Exception in its async helper output escaping, where a helper value carrying a truthy but non-callable toHTML property causes handlebars' escapeExpression to invoke it ...

CVE-2026-87123

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

EUVD-2026-76029

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123

hbs is an Express view engine wrapper for Handlebars. In version 4.3.0 , an unhandled TypeError is thrown during output escaping when an async helper (registered via registerAsyncHelper) resolves to an object whose toHTML property is truthy but not callable. Because the async substitution execute...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123: Uncaught Exception

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

PT-2026-89815

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

Cross-site Scripting (XSS)

Overview hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Cross-site Scripting XSS via the replaceAsyncValues render path in lib/hbs.js. An attacker can inject script into rendered HTML by supplying attacker-controlled data to a...

EUVD-2026-65392

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2022-49371 driver core: fix deadlock in __device_attach

In the Linux kernel, the following vulnerability has been resolved: driver core: fix deadlock in deviceattach In deviceattach function, The lock holding logic is as follows: ... deviceattach devicelockdev // get lock dev asyncscheduledevdeviceattachasynchelper, dev; // func asyncschedulenode...